{"id":"EUVD-2026-103378","enisaUuid":"df6c9c8f-dfbd-3232-8b99-fc67742db197","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","datePublished":"Oct 18, 2026, 12:07:21 AM","dateUpdated":"Oct 18, 2026, 11:12:55 AM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5\n","aliases":"CVE-2026-111997\nGHSA-p3hm-x653-5rc6\nGHSA-rxp7-6hxx-x8q5\n","assigner":"mitre","epss":0.32,"enisaIdProduct":[{"id":"c214b143-d85e-3a62-84f6-41a1d0c352cf","product":{"name":"ip-address","vendor":{"name":"beaugunderson"}},"product_version":"0 \u003c10.7.4"}],"enisaIdVendor":[{"id":"b8767526-aa48-3fe7-81e6-a0c34f613571","vendor":{"name":"beaugunderson"}}],"enisaIdVulnerability":[{"id":"33141aaa-4060-3f5b-ae41-2677affda455","vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","datePublished":"Oct 22, 2026, 4:19:39 PM","dateUpdated":"Oct 22, 2026, 4:19:39 PM","baseScore":0.0,"references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111997\nhttps://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd\nhttps://github.com/beaugunderson/ip-address\nhttps://github.com/beaugunderson/ip-address/releases/tag/v10.7.4\n","enisa_id":"EUVD-2026-103378\n","aliases":"CVE-2026-111997\nGHSA-rxp7-6hxx-x8q5\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"64149407-4433-32e7-a774-be881a4ac848","vulnerability":{"id":"CVE-2026-111997","description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","datePublished":"Oct 18, 2026, 12:07:21 AM","dateUpdated":"Oct 18, 2026, 11:12:55 AM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5\n","enisa_id":"EUVD-2026-103378\n","assigner":"mitre","epss":0.32,"dataProcessed":"Nov 4, 2026, 7:13:44 AM","vulnerabilityProduct":[{"id":"dd88f466-e205-3d49-b3b7-0b615761fce5","product":{"name":"ip-address","vendor":{"name":"beaugunderson"}},"product_version":"0 \u003c10.7.4"}],"vulnerabilityVendor":[{"id":"bd9c7056-af48-3b4d-8a4e-ac3ccd9f7ca3","vendor":{"name":"beaugunderson"}}]}},{"id":"e17e02e2-45e8-3a5e-bf10-fe122decb2b8","vulnerability":{"id":"GHSA-p3hm-x653-5rc6","description":"Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","datePublished":"Oct 18, 2026, 3:32:37 AM","dateUpdated":"Oct 22, 2026, 4:19:28 PM","baseScore":0.0,"references":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111997\n","enisa_id":"EUVD-2026-103378\n","aliases":"GHSA-p3hm-x653-5rc6\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}